Privacy Policy

Expense Me Back ("EMB", "we", "us") is a personal expense management application that helps you scan, categorise, and report expenses. This Privacy Policy explains what data we collect, why we collect it, how it is processed, and your rights under UK GDPR.

• Account data: Name, email address (used for authentication and report delivery)
• Profile data: Reporting name, employer email, saved recipient emails, currency and reporting preferences
• Expense data: Merchant, description, receipt date, amounts (net, VAT, gross), category, payment method, location, reporting period
• Receipt data: Photographs or PDF documents of receipts uploaded by you
• Submission history: Dates, totals, and generated PDF reports
• Technical data: Device and application information required to operate the service

Your data is processed to provide the EMB service: scanning receipts with AI/OCR, categorising expenses, generating reports, and delivering them via email or share. We do not use your expense data for advertising profiling or sell your information to third parties.

When you scan or upload a receipt, the image is sent to an AI/OCR provider for extraction of merchant, date, amounts, and category. The minimum data necessary is sent for this purpose. Receipt images are processed to extract expense information and are retained as part of your expense records until you delete them or your account.

Receipt data is not used to train third-party AI models. Processing may occur on servers outside the UK; by using EMB you acknowledge this transfer as described in Section 8.

• Base44: Application backend, database, authentication, and file storage
• AI/OCR provider: Receipt image processing and data extraction
• Email provider: Delivery of expense reports to recipients you select
• Storage provider: Secure storage of receipt files and generated PDFs

Your expense data, receipts, and submission history are retained for as long as your account is active. When you delete an expense or your account, the associated data is removed. Backups may retain deleted data for a limited period in accordance with our backup policy before permanent deletion.

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with the ICO

Some processing may occur outside the UK through our third-party providers. We take appropriate measures to ensure your data is protected in accordance with UK GDPR requirements, including standard contractual clauses where applicable.

All network communication uses HTTPS/TLS encryption. Passwords are hashed — never stored in plain text. Receipts and reports are stored securely. Access to your data is authenticated and restricted to your account.

You can delete your account and all associated data directly from Settings → Account Deletion. This removes your expenses, receipts, reports, submission history, and profile information.

For privacy enquiries or to exercise your rights, contact us through the support channel provided in the app or store listing.